@volter/world-core 2.0.20 → 2.0.21

package/dist/inject.cjs

@@ -728,8 +728,9 @@ function socketTargetHosts(args, isTls) {
     return hosts;
   }
   if (typeof first === 'string' && !/^\d+$/.test(first)) return hosts; // a unix socket path
-  hosts.push(typeof second === 'string' ? second : 'localhost');
   const options = typeof second === 'object' && second !== null ? second : typeof third === 'object' && third !== null ? third : null;
+  // connect(port, host) names the host; connect(port, { host }) puts it in the options, which Node merges
+  hosts.push(typeof second === 'string' ? second : typeof options?.host === 'string' ? options.host : 'localhost');
   if (isTls && options && options.servername) hosts.push(options.servername);
   return hosts;
 }
@@ -811,7 +812,15 @@ function patchedPromisesLookup(original) {
   };
 }
 
-function socketRefusal(hostname) {
+/** The port a net/tls connect names (`connect(port, host)`, `connect({ port, host })`), or undefined. */
+function socketTargetPort(args) {
+  const [first] = args;
+  const raw = first !== null && typeof first === 'object' ? first.port : first;
+  const port = Number(raw);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : undefined;
+}
+
+function socketRefusal(hostname, port, isTls) {
   const host = String(hostname || '').toLowerCase();
   if (host === WORLD_ADDRESS[4] || host === WORLD_ADDRESS[6]) {
     return `[twin-inject] refused a socket to ${host}, the address this World's DNS gives the names it routes: `
@@ -831,8 +840,11 @@ function socketRefusal(hostname) {
     return `[twin-inject] refused a raw socket to ${host}, which this world routes to the application (volter-world app-url --host): `
       + 'the client opened its own connection instead of going through http/https or fetch, so it could not be routed.';
   }
-  const url = (() => { try { return new URL(`https://${isIP(host) === 6 ? `[${host}]` : host}/`); } catch { return null; } })();
-  if (url && shouldBlockUntwinned(url)) return `[twin-inject] blocked untwinned external socket to ${host}`;
+  // the destination as an origin, its port and its protocol included: a policy that lists https://host allows TLS to
+  // host:443, never another port or a plaintext connection to it
+  const authority = `${isIP(host) === 6 ? `[${host}]` : host}${port !== undefined && !(isTls && port === 443) ? `:${port}` : ''}`;
+  const url = (() => { try { return new URL(`${isTls ? 'https' : 'http'}://${authority}/`); } catch { return null; } })();
+  if (url && shouldBlockUntwinned(url)) return `[twin-inject] blocked untwinned external socket to ${authority}`;
   return null;
 }
 
@@ -844,8 +856,9 @@ function refusedSocket(message) {
 
 function patchedConnect(originalConnect, isTls) {
   return function patchedSocketConnect(...args) {
+    const port = socketTargetPort(args);
     for (const host of socketTargetHosts(args, isTls)) {
-      const refusal = socketRefusal(host);
+      const refusal = socketRefusal(host, port, isTls);
       if (refusal) return refusedSocket(refusal);
     }
     return originalConnect.apply(this, args);

package/dist/network-policy.cjs

@@ -66,9 +66,11 @@ function isWorldInternalHost(hostname) {
   const v4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(h);
   if (v4) {
     const a = Number(v4[1]); const b = Number(v4[2]);
-    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+    // not link-local 169.254/16: it holds a cloud's instance metadata (169.254.169.254), the box's credentials
+    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
   }
-  return h.includes(':') && (h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe80:'));
+  // nor fe80::/10, nor a cloud's IPv6 metadata address (fd00:ec2::254)
+  return h.includes(':') && (h.startsWith('fc') || h.startsWith('fd')) && h !== 'fd00:ec2::254';
 }
 
 /**

package/inject.cjs

@@ -728,8 +728,9 @@ function socketTargetHosts(args, isTls) {
     return hosts;
   }
   if (typeof first === 'string' && !/^\d+$/.test(first)) return hosts; // a unix socket path
-  hosts.push(typeof second === 'string' ? second : 'localhost');
   const options = typeof second === 'object' && second !== null ? second : typeof third === 'object' && third !== null ? third : null;
+  // connect(port, host) names the host; connect(port, { host }) puts it in the options, which Node merges
+  hosts.push(typeof second === 'string' ? second : typeof options?.host === 'string' ? options.host : 'localhost');
   if (isTls && options && options.servername) hosts.push(options.servername);
   return hosts;
 }
@@ -811,7 +812,15 @@ function patchedPromisesLookup(original) {
   };
 }
 
-function socketRefusal(hostname) {
+/** The port a net/tls connect names (`connect(port, host)`, `connect({ port, host })`), or undefined. */
+function socketTargetPort(args) {
+  const [first] = args;
+  const raw = first !== null && typeof first === 'object' ? first.port : first;
+  const port = Number(raw);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : undefined;
+}
+
+function socketRefusal(hostname, port, isTls) {
   const host = String(hostname || '').toLowerCase();
   if (host === WORLD_ADDRESS[4] || host === WORLD_ADDRESS[6]) {
     return `[twin-inject] refused a socket to ${host}, the address this World's DNS gives the names it routes: `
@@ -831,8 +840,11 @@ function socketRefusal(hostname) {
     return `[twin-inject] refused a raw socket to ${host}, which this world routes to the application (volter-world app-url --host): `
       + 'the client opened its own connection instead of going through http/https or fetch, so it could not be routed.';
   }
-  const url = (() => { try { return new URL(`https://${isIP(host) === 6 ? `[${host}]` : host}/`); } catch { return null; } })();
-  if (url && shouldBlockUntwinned(url)) return `[twin-inject] blocked untwinned external socket to ${host}`;
+  // the destination as an origin, its port and its protocol included: a policy that lists https://host allows TLS to
+  // host:443, never another port or a plaintext connection to it
+  const authority = `${isIP(host) === 6 ? `[${host}]` : host}${port !== undefined && !(isTls && port === 443) ? `:${port}` : ''}`;
+  const url = (() => { try { return new URL(`${isTls ? 'https' : 'http'}://${authority}/`); } catch { return null; } })();
+  if (url && shouldBlockUntwinned(url)) return `[twin-inject] blocked untwinned external socket to ${authority}`;
   return null;
 }
 
@@ -844,8 +856,9 @@ function refusedSocket(message) {
 
 function patchedConnect(originalConnect, isTls) {
   return function patchedSocketConnect(...args) {
+    const port = socketTargetPort(args);
     for (const host of socketTargetHosts(args, isTls)) {
-      const refusal = socketRefusal(host);
+      const refusal = socketRefusal(host, port, isTls);
       if (refusal) return refusedSocket(refusal);
     }
     return originalConnect.apply(this, args);

package/network-policy.cjs

@@ -66,9 +66,11 @@ function isWorldInternalHost(hostname) {
   const v4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(h);
   if (v4) {
     const a = Number(v4[1]); const b = Number(v4[2]);
-    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+    // not link-local 169.254/16: it holds a cloud's instance metadata (169.254.169.254), the box's credentials
+    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
   }
-  return h.includes(':') && (h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe80:'));
+  // nor fe80::/10, nor a cloud's IPv6 metadata address (fd00:ec2::254)
+  return h.includes(':') && (h.startsWith('fc') || h.startsWith('fd')) && h !== 'fd00:ec2::254';
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.20",
+  "version": "2.0.21",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",